> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reputably.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Sign in with OAuth, or create an agent key. Both land on the same permissions.

There are two ways to authenticate, and they reach exactly the same surface. Which one you
want depends on whether a human is present to click **Approve**.

<CardGroup cols={2}>
  <Card title="Sign in (OAuth 2.1)" icon="user-check">
    For Claude Code, Claude Desktop, claude.ai and any MCP client that can open a browser.
    No key is copied or stored anywhere.
  </Card>

  <Card title="Agent key" icon="key">
    For CI, scripts, backends and clients with no sign-in flow. A bearer token you paste
    into a config file.
  </Card>
</CardGroup>

<Note>
  Both are clamped to the same read plus safe-write ceiling. Authenticating differently
  never widens what you can call, so choose on convenience rather than access.
</Note>

## Sign in with OAuth

The MCP endpoint is fronted by its own OAuth 2.1 authorization server, so a client only
needs a URL. It registers itself, no client id or secret required.

```bash theme={null}
claude mcp add --transport http reputably https://app.reputably.net/api/mcp
# then run /mcp and choose "Authenticate"
```

Two things worth knowing:

* **The issuer is per hostname.** `app.reputably.net` and every verified white-label domain
  are each their own authorization server. Connect on the domain you actually use, and you
  sign in and consent on that domain's branding. A token issued for one host is refused on
  another.
* **Discovery lives at the origin root**, not under `/api`:
  `https://app.reputably.net/.well-known/oauth-authorization-server`.

Connected apps are listed under **Settings → API & MCP → Connected apps**, where each one
can be disconnected individually.

## Create an agent key

Agent keys are managed by the **agency owner** in **Settings → API & MCP**. One active key
per agency.

```bash theme={null}
curl https://app.reputably.net/api/functions/getActiveSyncs \
  -H "Authorization: Bearer rpk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'
```

<Warning>
  The key is shown **once**, when you create or rotate it. Only a hash is stored, so it can
  never be displayed again. Lose it and you rotate.
</Warning>

Three behaviours that surprise people:

* **Rotating revokes every live key**, not just the one shown on screen, and mints a fresh
  one. After it returns, no previous key works.
* **Revoking a key does not disconnect OAuth apps.** They are a separate credential with a
  separate lifecycle. Disconnect those under **Connected apps**.
* **The key acts as the owner.** Requests inherit that account's workspace access, then get
  clamped to the read plus safe-write surface.

## Bearer only

Every request on this surface authenticates with an `Authorization: Bearer` header. A
browser cookie session can never drive it, by design: a cross-site request automatically
attaches cookies, and it can never attach a header. A `401` with a `WWW-Authenticate`
challenge means the header is missing, or the credential in it was revoked or is not
recognised.

## White-label domains

If you reach Reputably on your agency's own verified domain, use that domain everywhere:
the MCP URL, the API base URL and OAuth discovery. The connection snippets inside
**Settings → API & MCP** are already filled in with the right host, which is the safest
place to copy them from.